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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address « 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 03 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- ff the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely, 

- ff NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)S Responsive to communication(s) filed on 30 July 1999 . 
2a)D This action is FINAL. 2b)[3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) D Claim(s) is/are pending in the application. 

4a) Of the above claim(s) - is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 1-30 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 185(a). 

1 1) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§ 119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)D All b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 . 
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1) [X] Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) Paper No(s). . 

2) |3 Notice of Drafts person's Patent Drawing Review (PTO-948) 5) EH Notice of Informal Patent Application (PTO-152) 

3) □ Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) □ Other: 
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DETAILED ACTION 

1 . This Action is in response to the information received on 30 July 1999. 

Drawings 

2. This application has been filed with informal drawings which are acceptable for 
examination purposes only. Formal drawings will be required when the application is 
allowed. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Heath et al. (US 5,553,239) hereinafter referred to as Heaths in view of White (US 
6,049,877) 

Regarding claim 1 , Heaths, Management Facility For Server Entry And 
Application Utilization In A Multi-Node Server, discloses, a method of determining 
access, the method comprising the steps of: receiving one or more requests to access a 
system (Heaths teaches that a server architecture for connecting to a plurality of remote 
client computers each seeking access to applications resident on the server, Heaths, 
Abstract, Fig. 1); However, Heaths does not explicitly disclose, for each request, 
determining whether to allow access to the system using access vector to identify an 
available access object. Thus, the artisan would have been motivated to look into the 
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related network application access art for potential methods and systems for 
implementing the access control of network applications. 

In the same field of endeavor, White, related Systems, Methods, And Computer 
Program Products For Authorizing Common Gateway Interface Application Requests, 
discloses in an analogous art network application access control. White teaches that a 
Web server receives a client request to execute a CGI (Common Gateway Interface) 
application from a client. The CGI is one of a set of secured CGI applications. If the 
request is not accompanied by authentication token (access vector), the authentication 
routine of the CGI creates an authentication token and transmits the token to the client, 
White, Abstract, col. 2, lines 50-55). Once a user has been granted access to a CGI 
application within the set (available access object), the user will have access to all CGI 
applications within the set until the authentication key expires, White, col. 3, lines 11-14) 

Accordingly, it would have been obvious to one of ordinary skill in the network 
application access art at the time the invention was made to have incorporated White's 
teachings of assigning a common authentication routine to each CGI application within 
a set which can generate and validate an authentication token, user-level access control 
may be provided such that any of multiple CGI applications within a set can be executed 
upon request by an authenticated client (White, col. 3, lines 2-7) with the teachings of 
Heaths, for the purpose of taking the following advantages: the authenticated access to 
CGI application that is web server-independent and operating system independent, 
White, col. 2, lines 39-43; col. 3, lines 14-16). White suggests user-access level can be 
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granted to a set of CGI applications on any web server running on any operating system 
(White, col. 3, lines 16-18). 

Regarding claim 2, Heaths-White discloses, wherein the access object comprises 
information regarding attributes of the access object (user authorization information) 
(White, Figs. 3, 4, 5; col. 2, lines 61-62; col. 7, lines 1-8). 

Regarding claim 3, Heaths-White discloses, wherein the step of determining 
further comprises the step of evaluating whether the request can be satisfied with an 
available access object based on one or more attributes of that access object (Heaths, 
col. 13, lines 29-31 ; col. 14, lines 3-4). (White also teaches that the validity of an 
authentication token is preferably based upon an authentication key and token data 
used to create the token, as described in col. 6, lines 62-67 and col. 7, lines 1-59). 

Regarding claim 4, Heaths-White discloses, further comprising the step of 
returning a result to the request (White, Abstract; Fig. 4, box 106; Fig. 5, box 216; col. 6, 
lines 26-29). 

Regarding claim 5, Heaths-White discloses, further comprising the step of 
modifying the access vector upon receiving an indication that a request has completed 
its access to the system (Heaths teaches that the connection management that 
monitors the user's level of online activity, terminating inactive connections both to save 
system resources and to limit unnecessary connection charges to the user, Heaths, 
Abstract; col. 3, lines 42-44). 

Regarding claim 6, Heaths-White discloses, further comprising the step of 
modifying the access vector to modify a number of access objects (Heaths teaches that 
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the application management that spreads users optimally among active application 
instances, maintaining a pool of available applications (access objects), initiating new 
instances when the pool is low, and which records a user's utilization of different 
applications for billing purposes, Heaths, Abstract; col. 3, lines 44-48). 

Regarding claims 7, 8, Heaths-White discloses, wherein the number of access 
objects is increased/decreased (Heaths teaches that the general approach of the 
invention id to distribute tasks to different functional modules in a manner that promotes 
efficiency and ready accommodation of large numbers of users without processing 
delays, Heaths, Abstract; col. 3, lines 53-57). 

Regarding claim 9, Heaths-White discloses, further comprising the step of 
modifying one or more attributes of an access object (White teaches that the CGI 
returns a form to the client requesting a user name and password. The CGI uses this 
information to grant access, thus providing user level access control at the CGI level, 
White, col. 2, lines 62-65; col. 7, lines 1-8; col. 8, lines 23-42). 

Regarding claim 10, Heaths-White discloses, further comprising the step of 
allowing one request at a time to manipulate the access vector (White teaches that a 
web server receives a client request to execute a CGI application from a client. 
Authentication routines shared by a set of CGIs are executed by the requested CGI 
application to determine if the request is accompanied by an authentication token, 
White, Abstract, col. 6, lines 62-67). 

Claim 1 1 recites an apparatus corresponding to the method of operation of claim 
1 . The apparatus claimed is obvious in that it simply follows the logical implementation 
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of the method indicated in the referenced claims to perform each of the logical steps of 
controlling access to web servers method that results from the combination of the 
references discussed above regarding the claims to the method of operation. Thus, the 
apparatus described in claim 1 1 would have been obvious in view of the elements 
provided in the combination of the references, which correspond to the steps in the 
method of operation for the same reasons discussed above regarding claim 1 . 

Claim 12 is substantially the same as claim 2 and is thus rejected for the reason 
similar to those in rejection claim 2. 

Claim 13 is substantially the same as claim 3 and is thus rejected for the reason 
similar to those in rejection claim 3. 

Claim 14 is substantially the same as claim 4 and is thus rejected for the reason 
similar to those in rejection claim 4. 

Claim 15 is substantially the same as claim 5 and is thus rejected for the reason 
similar to those in rejection claim 5. 

Claim 16 is substantially the same as claim 6 and is thus rejected for the reason 
similar to those in rejection claim 6. 

Claim 17 is substantially the same as claim 7 and is thus rejected for the reason 
similar to those in rejection claim 7. 

Claim 18 is substantially the same as claim 8 and is thus rejected for the reason 
similar to those in rejection claim 8. 

Claim 19 is substantially the same as claim 9 and is thus rejected for the reason 
similar to those in rejection claim 9. 
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Claim 20 is substantially the same as claim 10 and is thus rejected for the reason 
similar to those in rejection claim 10. 

Regarding claim 21 , Heaths-White discloses an article of manufacture 
comprising a computer program carrier readable by a computer and embodying one or 
more instructions (White, col. 6, lines 4-8) executable by the computer to perform the 
method steps for determining access as in the apparatus of claim 1 1 above. The 
Examiner takes Official Notice (see MPEP 2144.03) that it is well known in the 
networking art to utilize a computer program carrier readable by a computer embodying 
one or more instructions for the storing and execution of the method and apparatus in 
order to perform the functional procedures for determining, controlling access to web 
servers and computer resources. Therefore, it would have been obvious to one of 
ordinary skill in the networking art at the time the invention was made to have included 
the use of a computer program carrier readable by a computer embodying one or more 
instructions executable by the computer to store and execute the procedures of 
managing computer network resources and determining access control because use of 
storage medium for programs used in general purpose computer to execute special 
purpose functions was routine in the art. 

Claim 22 is substantially the same as claim 12 and is thus rejected for the reason 
similar to those in rejection claim 12. 

Claim 23 is substantially the same as claim 13 and is thus rejected for the reason 
similar to those in rejection claim 13. 
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Claim 24 is substantially the same as claim 14 and is thus rejected for the reason 
similar to those in rejection claim 14. 

Claim 25 is substantially the same as claim 15 and is thus rejected for the reason 
similar to those in rejection claim 5. 

Claim 26 is substantially the same as claim 16 and is thus rejected for the reason 
similar to those in rejection claim 16. 

Claim 27 is substantially the same as claim 17 and is thus rejected for the reason 
similar to those in rejection claim 17. 

Claim 28 is substantially the same as claim 18 and is thus rejected for the reason 
similar to those in rejection claim 18. 

Claim 29 is substantially the same as claim 19 and is thus rejected for the reason 
similar to those in rejection claim 9. 

Claim 30 is substantially the same as claim 20 and is thus rejected for the reason 
similar to those in rejection claim 20. 

Prior Art Of Record 
5. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Baker et al. (US 5444859), Terry et al. (US 5581753), Dykes et al. (US 5872915), 
Cheng et al. (US 5881232), Brandt et al. (US 5892905), McCollum et al. (US 6006228), 
Brandt et al. (6125384), Brandt et al. (6144990), Dresel et al. (US 617,019 B1 ) are 
related to prior art disclosing implementation of network data access control systems. 
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Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Hai V. Nguyen whose telephone number is 703-306- 
0276. The examiner can normally be reached on 8:00-4:30 Mon-Fri. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Mark Rinehart can be reached on 703-305-4815. The fax phone numbers 
for the organization where this application or proceeding is assigned are 703-746-7240. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3230. 




Hai V. Nguyen 
Examiner 

Art Unit 2152 ^ WARK H. RINEHART 

SUPERVISORY PATENT EXAMINER 
HVN TECHNOLOGY CENTER 2100 

December 14, 2001 



